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(54) Abstract Title 

Network management apparatus with graphical representation of monitored values 



(57) A network management apparatus (3A) and method 
for processing network management data receives values 
for a monitored characteristic of a part of a network (1). 
Each time a new value for the monitored characteristic is 
received, a statistical value representing a level of the 
monitored characteristic over time is calculated. In one 
embodiment the statistical value is a statistical average of 
received values over time, and in another embodiment 
the statistical value is the number of times the value of the 
monitored characteristic exceeds a predetermined 
threshold, for instance indicating high stress. The 
statistical value is then used to determine a graphical 
representation of the part of the network. For instance, an 
icon representing a device on the network has a size in 
proportion with the statistical value. Similarly, a line 
representing a link on the network has a thickness 
depending upon the statistical value. The determined 
graphical representation is then used in the display of a 
network map (17A)(Fig.3). Alternatively, the colour of an 
icon may change in dependance upon the statistical value. 
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At least one drawing originally filed was informal and the print reproduced here is taken from a later filed formal copy. 
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RECEIVE A NEW STRESS VALUE FOR 
A MONITORED CHARACTERISTIC 
FOR PART OF THE NETWORK 



CALCULATE A STATISTICAL VALUE 
REPRESENTING THE STRESS 
LEVEL OF THE MONITORED 
CHARACTERISTIC OVER TIME 



DETERMINE A GRAPHICAL 
REPRESENTATION FOR THE PART OF 
THE NETWORK CORRESPONDING TO 

THE STATISTICAL VALUE 



PRESENT THE DETERMINED 
GRAPHICAL REPRESENTATION 
ON A NETWORK MAP 
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NETWORK MANAGEMENT APPARATUS AND METHOD 
FOR MONITORING STRESS OF A NETWORK 

The present invention relates generally to an apparatus and method for the 
management of a network, and more particularly to a network management apparatus 
and method for use in monitoring the health or stress of a network. 

The following description is concerned with a data communications network, 
and in particular a local area network (LAN) but has more widespread applicability to 
other managed communications systems including wide area networks (WANs) or 
wireless communications systems. 

Networks typically comprise a plurality of computers, peripherals and other 
electronic devices capable of communicating with each other by sending and 
receiving data packets in accordance with a predefined network protocol. Each 
computer or other device on the network is connected by a port to the network media, 
which in the case of a LAN network may be coaxial cable, twisted pair cable or fibre 
optic cable. Each device on the network typically has hardware for media access 
control (MAC) with its own unique MAC address. Data packets are sent and received 
in accordance with the MAC protocol (e.g. CSMA/CD protocol as defined by the 
standard IEEE 802.2, commonly known as Ethernet). Data packets transmitted using 
the MAC protocol identify the source MAC address (i.e. the MAC address of the 
device sending the data packet) and the destination MAC address (i.e. the MAC 
address of the device for which the data packet is destined) in the header of the data 
packet 

A network is generally configured with core devices having a plurality of 
ports, which can be used to interconnect a plurality of media links on the network. 
Such devices include hubs, routers and switches which pass data packets received at 
one port to one or more of its other ports, depending upon the type of device. Such 
core devices can either be managed or unmanaged. 



It is becoming increasingly common for an individual, called the network 
administrator, to be responsible for network management, and his or her computer 
system or workstation is typically designated the network management station. The 
network management station incorporates the manager, as defined in the SNMP 
protocol, i.e. the necessary hardware, and software applications to retrieve data from 
MTOs by sending standard SNMP requests to the agents of managed devices on the 
network. 

Network management software applications are known which can determine 
the topology of a network, i.e. the devices on the network and how they are linked 
together. In order to determine the network topology, the application retrieves data 
from the managed devices on the network, which data can provide information about 
the devices connected to the managed devices, for instance the aforementioned 
"address tables". MIB data can also be retrieved from managed devices to provide 
information about device type, device addresses and details about the links. Using 
such data, the application can usually determine the topology of the entire network. 

An example of a known network management software application capable of 
determining network topology is the Transcend* Network Supervisor application 
available from 3Com Corporation of Santa Clara, California, USA. 

A part of the network administrator's function is to identify and resolve 
problems occurring on the network, such as device or link malfunction or failure. In 
order to provide the network administrator with the necessary information to identify 
such problems, the network management application monitors the devices on the 
network. An example of such monitoring is described in co pending UK Patent 
Application No 9917993.9 entitled "Management System and Method for Monitoring 
Stress in a Network" in the name of the present applicant. In the system and method 
described in UK Patent Application No 9917993.9 the SNMP manager in the network 
management station requests the agents of managed network devices on the network 
device to retrieve selected MIB data indicative of device and link operation, and 
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An alternative way of presenting the monitored data to the network 
administrator is to display a graphical representation of the network as a "network" 
map. Each device on the network is represented by an appropriate device icon and the 
links between devices are represented by lines connecting the device icons on the 
network map. The monitored stress values for each device and link are displayed in 
association with the corresponding icon on the network map (e.g. by clicking on a 
device icon to open a window showing the monitored values). The icons representing 
devices and lines representing links may be coloured to represent the stress levels. 
For example, the colour green may be used for low stress levels, and red may be used 
to represent high stress levels. 

A problem with this method of presenting management data to the network 
administrator is that the network map represents the most recently monitored stress 
levels associated with the network. It does not reflect past performance and cannot 
provide clues to problems found previously, since the network map is continually 
updated as the devices are monitored. Thus, if a malfunctioning device or link 
happens to be working at the time the administrator views the network map, the 
administrator is not alerted to the problem. 

It would be desirable to provide a network management system and method 
which addresses the aforementioned problems. 

In accordance wkh a first aspect, the present invention provides a method for 
processing network management data' comprising: receiving a new value for a 
monitored characteristic of a part of a network for which at least one previous value 
has been received; calculating a statistical value representing a level of the monitored 
characteristic over time, and determining a graphical representation of the part of the 
network corresponding to the statistical value. 

The method can thus be used to produce a graphical representation for use in a 
network map to visibly distinguish parts of the network which have a history of high 



7 



Figure 1 shows a typical local area network 1. The network 1 operates various 
protocols within the TCP/DP protocol suite, as described above. The network 1 
includes SNMP managed network devices including hubs 11 and 12, and switch 7 
which are connected together by media links 5. End stations, in the form of personal 
5 computers (PCs) 3 are provided for users, including management station 3A for the 
network administrator. The PCs 3 are unmanaged network devices. Each PC 3 is 
connected to a core managed device, such as hub 11, which in turn is connected to 
switch 7. The hubs 1 1 and 12 and switch 7 are managed devices which communicate 
management information with management station 3A using the SNMP protocol. The 
10 agent within each core managed network device monitors data traffic passing through 
its ports and stores the data thereby obtained in an appropriate location in a MB. 
Typically, the MDB data is represented in the form of "conceptual tables" (called 
"MIB tables") as is well known in the art. A typical managed device may implement 
a number of MIBs for network management. 

15 

An example of a MIB containing network management data is MTR-TI 
(formerly MB-I) defined by RFC 1213: Management Information Base for Network 
Management of TCP/IP Internets. In the network 1, hubs 1 1 and 12 and switch 7 
store MDB-II data. Another MIB containing more complex management data is 
20 RMON (as defined in RFC 1757: Remote Network Monitoring Management 
Information Base) and in the network 1, only switch 7 stores RMON data. 

Figure 2 shows a map 17 of the network 1 of Figure 1. Such a network map 
17 is produced using a conventional network management software application, such 
as the Transcend® Network Supervisor application available from 3Com Corporation 
of Santa Clara, California, USA. Such a network management application 
"discovers" the network topology by interrogating the managed network devices i.e. 
hubs 1 1 and 12 and switch 7 on the network using the SNMP protocol. The data 
received is then processed to determine the number and type of network devices on 
the network, and how they are linked together. This information is then used to 
produce the network map which is displayed on a display screen 15 of the network 
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and 12 and switch 7, and RMON data from switch 7 and processing the received data, 
and by periodically polling all network devices using Ping or service requests and 
monitoring response times. For Ping and service requests, the management station 3 A 
waits a predetermined period of time before it considers that a response has not been 
5 received and the request is "timed out". 

The network management station 3A indicates the thus determined stress 
values in association with the network map 17. For instance, if no response is 
received to an IP Ping of an endstation 3, the network map will illustrate the 
10 endstation icon in red. Clicking on the icon will reveal further details i.e. that the 
endstation has a high level of stress because no response was received to the most 
recent IP Ping from the network management station 3 A. 

The network map 17 is continually updated, each time the network 
15 management station 3 A receives a new stress value during its monitoring process. 
Thus, the network map 17 only represents the stress of the network I at a particular 
moment in time and does not represent past stress levels indicating past performance. 

In accordance with a preferred embodiment of the present invention, the 
20 network management station 3A generates, either in addition to or in place of the 
conventional network map 17, a network map 17A representative of past and current 
stress levels. In particular, the network management station 3A determines an 
aggregate or average stress level for each monitored stress metric for each part of the 
network 1 and represents the average or aggregate stress levels on the network map. 

25 

Figure 3 shows a network map 17A of a more complex network representing 
the aggregate or average stress levels generated in accordance with the preferred 
embodiment. The network map 17A uses different colours for map icons and lines, 
different line thicknesses and different icon sizes to represent the aggregate or average 
30 stress level for the corresponding device or link. 
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slightly thicker than those representing low aggregate stress. Devices under high 
aggregate stress are represented by large red icons, and links under high stress are 
represented by thick red lines. 

5 This may be achieved using an algorithm which maps an aggregated stress 

level onto a corresponding graphical representation of the device or link on the 
network map. 

For example, consider an arbitrary numeric range for aggregated stress values 
10 for a link, such as 0 to 100, where 0 is minimum stress and 100 is mflxnrmm stress. 
An aggregate stress ("stress") for a link of 0 will nap onto a line of minimum width 
("min width" e.g. 1 pixel width) coloured "saturated green". An aggregate stress for a 
link of 100 will map onto a line of maximum width ("max width" e.g. 3 pixels) 
coloured "saturated red". Aggregate stress values between 0 and 100 will map 
1 5 linearly according to the following equations: 

line width = min width + ((max width - min width) / 100) * stress 

line colour = stress / 100 * (saturated red) + (1 - (stress / 100)) * (saturated green) 
20 where the V operation indicates a mixing of the two colours. 

A Mmilar operation could be used to map the aggregate stress values for a 
device to a corresponding size and colour of icon. 

25 The differences in size of the icons and lines and/or the use of colour in the 

network map 17A, enables the network administrator to readily identify areas of the. 
network having high stress and to determine whether the parts of the network under 
high stress are related or isolated. 
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For instance, Figure 3 shows that there are a group of devices and links under 
high stress around node B. These problems are probably related. The high stress 
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ends at step 105 unless, in the meantime, it receives a new stress value, in which case 
the program continues from step 101. 

Figure 5 shows the program substeps performed in step 102 of Figure 4 in 
5 accordance with a first example. In this first example, the program calculates an 
average stress value for the monitored characteristic. The stress value may be a 
normalised stress value, for instance determined as described in UK Patent 
Application No 9917993.9, or a stress value otherwise determined using raw data 
obtained during monitoring of the stress metric. The program stores the sum of 
10 previously received stress values for the monitored metric in memory and has a 
counter the value of which represents the number of stress values received for the 
monitored metric. 

According to the substeps shown in Figure 5, when a new stress value is 
15 received by the program at step 101 of Figure 4, in step 201, the counter is 
incremented by one. The received stress value in step 102 is then added to the sum of 
previously received stress values for the monitored metric in step 202. This is 
• achieved by retrieving the sum from memory, and adding it to the new stress value. 
The result is then stored in memory at step 203. The value stored in step 203 is then 
20 divided by the count value of the counter resulting from step 201, in step 204, thus 
determining the average stress value. The program then continues with step 103 of 
Figure 4. 

Figure 6 shows the substeps performed by the program in step 102 of Figure 4, 
25 in accordance with a second example. In the second example, the value determined in 
step 102 is an aggregate value representing the number of times the stress value for 
the monitored characteristic of the relevant part of the network is high Le. the stress 
value indicates unacceptable performance. As previously described, threshold values 
for each stress metric are predetermined, and stress values greater than or equal to the 
30 threshold are considered to represent high stress, and are considered to represent 
"Events". 
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CLAIMS : 

1 . A method for processing network management data comprising 

receiving a new value for a monitored characteristic of a part of a network for 
which at least one previous value has been received; 

calculating a statistical value representing a level of the monitored 
characteristic over time, and 

determining a graphical representation of the part of the network 
corresponding to the statistical value. 

2. A method as claimed in claim 1, wherein the monitored characteristic relates 
to the stress of the part of the network. 

3. A method as claimed in claim 1 or claim 2, wherein the statistical value is a 
statistical average of received values for the monitored characteristic. 

4. A method as claimed in claim 3, wherein the statistical average is determined 
by the steps of: 

adding together the new value and the at least one previously received values 
for the monitored characteristic to produce a total; and 

dividing the total by the number of received values for the monitored 
characteristic. 

5. A method as claimed in claim 4, further comprising storing the total in 
memory. 

6. A method as claimed in claim 4 or claim 5, further comprising, after the step 
of receiving a new value and before the step of calculating, incrementing a counter by 
one, wherein the count value of the counter represents the number of received values 
for the monitored characteristic. 
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16. A method for processing network management data substantially as 
hereinbefore described, with reference to, and as illustrated by Figures 4 and 5 or 
Figures 4 and 6 of the accompanying drawings. 

17. A computer readable medium carrying a computer program for carrying out 
the method as claimed in any one of claims 1 to 16. 



18. A network management apparatus for operating the method as claimed i 
one of claims 1 to 16. 
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